CONFIG_CFI_CLANG: Use Clang's Control Flow Integrity (CFI)

General informations

The Linux kernel configuration item CONFIG_CFI_CLANG:

• prompt: Use Clang's Control Flow Integrity (CFI)
• type: bool
• depends on: ( CONFIG_ARCH_SUPPORTS_CFI_CLANG ) && ($( CONFIG_cc-option,-fsanitize = CONFIG_kcfi ))
• defined in arch/Kconfig
• found in Linux kernels: 5.13–5.19, 6.0–6.12, 6.13-rc+HEAD

Help text

This option enables Clang's forward-edge Control Flow Integrity (CFI) checking, where the compiler injects a runtime check to each indirect function call to ensure the target is a valid function with the correct static type. This restricts possible call targets and makes it more difficult for an attacker to exploit bugs that allow the modification of stored function pointers. More information can be found from Clang's documentation:

https://clang.llvm.org/docs/ControlFlowIntegrity.html

Hardware

LKDDb

Raw data from LKDDb:

• (none)

Sources

This page is automaticly generated with free (libre, open) software lkddb(see lkddb-sources).

The data is retrived from:

• Linux kernel
• Linux Kernel Driver DataBase (LKDDb)

Automatic links from Google (and ads)

Custom Search

Popular queries: